On Fri, Jun 12, 2026 at 03:42:59PM +0200, Marta Lewandowska wrote: > > > > > Since confidential VMs rely on remote attestation, TPM PCR values need > > > to be stable and predictable over long periods of time. Updating the > > > bootloader results in changes to PCRs, and should therefore be avoided > > > if possible. > > > > What is the plan for the grub configuration? One of the big issues when > > it comes to PCR pre-calculation is that grub hashes every config file > > line processed into one of the PCRs. > > > There is a very simple grub.cfg baked into the binary which is just: > timeout=5 > blscfg
Does this fully disable the interactive editting UI for boot entries, such that only the embedded cmdline/initrd from the UKI can be used ? With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :| -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
